topic Re: How to use a lookup to validate hosts against metadata in Splunk Search

How to use a lookup to validate hosts against metadata

a212830 — Mon, 12 Sep 2016 01:35:13 GMT

Hi,

Is it possible to create a lookup, and then validate that data has been received from each host in the lookup by comparing it againsts metadata?

Re: How to use a lookup to validate hosts against metadata

HiroshiSatoh — Tue, 29 Sep 2020 10:55:19 GMT

How about this?
ex.
lookup(my_hosts_list.csv):all
metadata:Match only

| inputlookup my_hosts_list.csv | join type=left host [| metadata type=hosts|eval match="true"|table host match]

Re: How to use a lookup to validate hosts against metadata

somesoni2 — Mon, 12 Sep 2016 04:49:19 GMT

Something like this should do it.

| inputlookup yourlookup.csv | eval recentTime=0 | append [| metadata type=hosts index=* | table host recentTime ] | stats max(recentTime) as recentTime by host | eval Result=if(recentTime=0,"Not Received","Received") | convert ctime(recentTime)

Re: How to use a lookup to validate hosts against metadata

a212830 — Mon, 12 Sep 2016 11:38:48 GMT

Thanks. Shows data that is "Received", but none that aren't. Should be missing about 30 or so...

My lookup has 195 entries, and this returns 166 events. All of them "received".

Re: How to use a lookup to validate hosts against metadata

a212830 — Mon, 12 Sep 2016 11:39:57 GMT

And, just to be clear, some of these might have never sent events.

Re: How to use a lookup to validate hosts against metadata

sloshburch — Mon, 12 Sep 2016 17:46:50 GMT

Sounds like you have duplicates in your lookup file.

Do this to see:

 | inputlookup yourlookup.csv
 | stats count, dc(host) AS unique_hosts

If count and unique_hosts are not equal then find your duplicates:

 | inputlookup yourlookup.csv
 | stats dc(host) AS unique_hosts by host
 | where host>1